3 Lifecycle of a National Cybersecurity Strategy 3.5 Phase V: Monitoring and evaluation During this phase, a competent authority should devise a formal process to monitor and evaluate the Strategy. In the monitoring phase, the government should ensure that the Strategy is implemented in accordance with its Action Plan. In the evaluation phase, the government and its competent authority should assess whether the Strategy is still relevant in light of the changing risk environment and whether it still reflects the government’s objectives and what adjustments are necessary. 3.5.1 Establishing a formal process To ensure effective monitoring and evaluation of the implementation of the Strategy, the government will have to identify an independent entity responsible for monitoring and evaluating the implementation progress and efficiency. The entity should ideally be involved in defining appropriate monitoring and evaluation metrics for the implementation of the Strategy and associated Action Plan and initiatives, which should take place during the Production and Initiation phases. Monitoring and measuring the performance and successful execution of the implementation plan for the Strategy should be part of the governance mechanisms that a country puts in place. Continuous assessment of the implementation plan (i.e. what is going well and what is not) helps inform the Strategy. Good governance mechanisms with regards to the Strategy implementation should also clearly delineate the accountability and responsibility for ensuring successful execution. Establishing metrics or key performance indicators (KPI) by near-term, mid-term and long-term objectives helps reinforce the governance and management mechanisms. Key performance indicators or metrics should be: · Specific – target a specific area for improvement. · Measurable – quantify or at least suggest an indicator of progress. · Achievable – state what results can realistically be achieved, given available resources. · Responsible – specify who will do it · Time-related – specify when the result(s) can be achieved. The establishment of baseline metrics will enable better monitoring of actions and highlight areas of potential improvement. Furthermore, the allocation of budgets should match the levels of ambition and complexity of the desired impact. Guide to Developing a National Cybersecurity Strategy 26